Microsoft’s October 2018 Security Update: There’s More to the Story

A week after Microsoft addressed 49 vulnerabilities in its October 2018 Security Update, new developments have emerged that change the threat profile of some of them.

Background

On Tuesday, October 9, Microsoft released its October 2018 Security Update, also known as Patch Tuesday. This security update contained fixes for 49 vulnerabilities. Since the publication of this security update, new developments have emerged that change the threat profile of some of these vulnerabilities. The most notable developments center around vulnerabilities in Microsoft Windows Shell, Microsoft Win32k.sys and Microsoft JET Database Engine.

Vulnerability details

On September 20, Trend Micro’s Zero Day Initiative (ZDI) published an advisory on CVE-2018-8423, a zero-day vulnerability in Microsoft Windows JET Database Engine. The advisory was published after researchers provided Microsoft with a responsible disclosure timeline of 120 days. Microsoft did release a patch for this vulnerability as part of the October 2018 Security Update. However, researchers from 0patch, a company that produces micropatches for vulnerable software, published a blog on October 12 claiming Microsoft’s patch for the JET Database Engine vulnerability was incomplete. At the time of publication, Microsoft has not responded to 0patch’s claim.

On October 10, Kaspersky Lab researchers published a blog on CVE-2018-8453, a zero-day vulnerability in Win32k.sys that its researchers discovered being exploited in the wild by an Advanced Persistent Threat (APT) group known as FruityArmor. This zero-day is an elevation of privilege vulnerability packaged as part of a malicious software (malware) installer used against less than 12 targets based in the Middle East region. Kaspersky notified Microsoft of this vulnerability in August 2018 and a patch was released as part of the October 2018 Security Update.

On October 11, researcher Abdulrahman Al-Qabandi published a blog around his discovery of a remote code execution vulnerability in Windows Shell, CVE-2018-8495. Al-Qabandi provided these details to the ZDI, which worked with Microsoft to address this issue in the October 2018 Security Update. In his blog, Al-Qabandi provides a Proof of Concept (PoC) revealing how the vulnerability can be exploited. The concern around a PoC being made available is that it provides malicious actors a blueprint to leverage this vulnerability to attack users in the wild.

Urgently required actions

Despite the claim that the patch for the JET Engine Database vulnerability is incomplete, customers are still advised to apply Microsoft’s October 2018 Security Update to all assets. Applying this update will address 49 CVEs, including the Win32k.sys and Windows Shell vulnerabilities.

It is unclear whether or not Microsoft will provide clarification about the claim made about the JET Engine Database vulnerability prior to the November 2018 Security Update. Until then, customers are advised to restrict interaction with vulnerable applications to trusted files.

While applying security updates and patches is vital, patching alone is just one part of a larger picture in securing assets. These developments underscore the importance of comprehensive security that encompasses having visibility into your assets, contextualizing potential risks to prioritize responses and taking action to close the Cyber Exposure gap.

Identifying affected systems

A list of Nessus plugins to identify vulnerable assets can be found here.

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Share this post and earn Cybytes

Follow

1592 Followers

About Tenable

Tenable™, Inc. is the Cyber Exposure company. Over 24,000 organizations of all sizes around the globe rely on Tenable to manage and measure their modern attack surface to accurately understand and reduce cyber risk. As the creator of Nessus®, Tenable built its platform from the ground up to deeply understand assets, networks and vulnerabilities, extending this knowledge and expertise into Tenable.io™ to deliver the world’s first platform to provide live visibility into any asset on any computing platform. Tenable customers include over 50 percent of the Fortune 500, large government agencies and organizations across the private and public sectors. Learn more at tenable.com.

Promoted Content

Five Steps to Building a Successful Vulnerability Management Program

Is your vulnerability management program struggling?
Despite proven technology solutions and the best efforts of IT teams, unresolved vulnerabilities remain an ongoing source of friction and frustration in many organizations. Regardless of how many vulnerabilities are fixed, there will always be vulnerabilities that can’t easily be remediated – and too often, finger-pointing between IT teams and business groups can ensue.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.